CVE-2026-28116

MediumCVSS 5.9

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Progress Planner plugin for WordPress up to version 1.9.0 contains a stored XSS vulnerability due to improper input neutralization during page generation.

Risk Assessment

An attacker can inject malicious JavaScript that executes in other users' browsers, potentially leading to session theft or data exfiltration.

Recommendation

Update the Progress Planner plugin to a version later than 1.9.0 if a patch is available, or remove the plugin.

Other vulnerabilities in Progress Planner

CVE-2026-62072High
The Progress Planner plugin versions up to 1.10.0 contain a Broken Access Control vulnerability from the subscriber role. This means a low-privileged user can gain unauthorized access to functions or data.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS